Protecting a network from a unicast flood

ABSTRACT

An approach is provided for protecting a network from a unicast flood. If the destination MAC address of a frame is not included in a table of unknown MAC addresses, the MAC address is added to the table and the frame is forwarded to non-blocked spanning tree links to find the MAC address in the network. If the MAC address is included in the table, and if a timer for suppressing forwarding of frames is active, the frame is discarded, or if the timer is inactive, a counter for counting received frames is incremented and compared to a threshold value. If the counter is greater than the threshold value, the timer is activated and the frame is discarded. If the counter is not greater than the threshold value, the frame is forwarded to the non-blocked spanning tree links to find the MAC address in the network.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation application claiming priority to Ser.No. 15/844,932 filed Dec. 18, 2017 which is a continuation applicationclaiming priority to Ser. No. 15/834,172 filed Dec. 7, 2017, thecontents of which are hereby incorporated by reference.

BACKGROUND

The present invention relates to managing computer networks, and moreparticularly to managing unicast floods in networks.

An unknown unicast flood is created by sending Ethernet frames to amedia access control (MAC) address that is unknown by a network. Sincethe destination MAC address is unknown, the frames are flooded out toall forwarding interfaces to all other switches, which in turn createsthe same flooding of unknown unicast traffic until the source of theframes stops sending. Unknown unicast floods can starve the network ofbandwidth and processing cycles.

Legitimate reasons for an unknown unicast frame to be seen includemismatched MAC aging timers between hosts and network devices where aknown destination is disconnected or powered off from the network, oraged out on a switch but not aged out on a host trying to communicate.

Currently known storm control techniques limit the impact of unknownunicast floods by using a suboptimal approach of limiting a link by apercent of utilization, leading to wasted network resources andaffecting legitimate traffic that is blocked when interface-wide limitsare reached.

SUMMARY

In one embodiment, the present invention provides a method of protectinga network from a unicast flood. The method includes a processor in aswitch of the network receiving a frame having a media access control(MAC) address that is unknown to the network. The MAC address is anaddress of a destination of the frame. The method further includes theprocessor determining whether the MAC address is included in a table ofunknown MAC addresses. The method further includes if the MAC address isnot included in the table, the processor adding the MAC address to thetable together with a timestamp and forwarding the frame to non-blockedspanning tree links to attempt to find the MAC address in the network,or if the MAC address is included in the table, the processordetermining whether a timer for suppressing forwarding of frames isactive, and if the timer for suppressing forwarding of frames is active,the processor discarding the frame, or if the timer for suppressingforwarding of frames is not active, the processor incrementing a counterfor counting received frames and determining whether the counter isgreater than a threshold value, and if the counter is greater than thethreshold value, the processor activating the timer for suppressingforwarding of frames for a period of time and discarding the frame, orif the counter is not greater than the threshold value, the processorforwarding the frame to the non-blocked spanning tree links to attemptto find the MAC address in the network.

In another embodiment, the present invention provides a computer programproduct for protecting a network from a unicast flood. The computerprogram product includes a computer readable storage medium. Computerreadable program code is stored on the computer readable storage medium.The computer readable storage medium is not a transitory signal per se.The computer readable program code is executed by a hardware processorof a computing device in the network to cause the computing device toperform a method. The method includes the processor receiving a framehaving a media access control (MAC) address that is unknown to thenetwork. The MAC address is an address of a destination of the frame.The method further includes the processor determining whether the MACaddress is included in a table of unknown MAC addresses. The methodfurther includes if the MAC address is not included in the table, theprocessor adding the MAC address to the table together with a timestampand forwarding the frame to non-blocked spanning tree links to attemptto find the MAC address in the network, or if the MAC address isincluded in the table, the processor determining whether a timer forsuppressing forwarding of frames is active, and if the timer forsuppressing forwarding of frames is active, the processor discarding theframe, or if the timer for suppressing forwarding of frames is notactive, the processor incrementing a counter for counting receivedframes and determining whether the counter is greater than a thresholdvalue, and if the counter is greater than the threshold value, theprocessor activating the timer for suppressing forwarding of frames fora period of time and discarding the frame, or if the counter is notgreater than the threshold value, the processor forwarding the frame tothe non-blocked spanning tree links to attempt to find the MAC addressin the network.

In another embodiment, the present invention provides a computer systemincluding a hardware processor; a memory coupled to the processor; and acomputer readable storage device coupled to the processor. The storagedevice includes instructions that are executed by the processor via thememory to implement a method of protecting a network from a unicastflood. The computer system is a switch in the network. The methodincludes the processor receiving a frame having a media access control(MAC) address that is unknown to the network. The MAC address is anaddress of a destination of the frame. The method further includes theprocessor determining whether the MAC address is included in a table ofunknown MAC addresses. The method further includes if the MAC address isnot included in the table, the processor adding the MAC address to thetable together with a timestamp and forwarding the frame to non-blockedspanning tree links to attempt to find the MAC address in the network,or if the MAC address is included in the table, the processordetermining whether a timer for suppressing forwarding of frames isactive, and if the timer for suppressing forwarding of frames is active,the processor discarding the frame, or if the timer for suppressingforwarding of frames is not active, the processor incrementing a counterfor counting received frames and determining whether the counter isgreater than a threshold value, and if the counter is greater than thethreshold value, the processor activating the timer for suppressingforwarding of frames for a period of time and discarding the frame, orif the counter is not greater than the threshold value, the processorforwarding the frame to the non-blocked spanning tree links to attemptto find the MAC address in the network.

Embodiments of the present invention protect networks from unknownunicast floods, thereby preventing the unknown unicast flood fromstarving a network of bandwidth and processing cycles, while minimizingeffects on legitimate network traffic and without wasting networkresources. Embodiments of the present invention facilitate identifyingwhether a malicious host is the source of an unknown unicast flood.without wasting network resources and while minimizing effects onlegitimate network traffic.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a system for protecting a network from aunicast flood, in accordance with embodiments of the present invention.

FIG. 2 is a flowchart of a process of protecting a network from aunicast flood, where the process is implemented in the system of FIG. 1,in accordance with embodiments of the present invention.

FIG. 3 is an example of determining whether to drop or discard anunknown unicast frame within the process of FIG. 2, in accordance withembodiments of the present invention.

FIG. 4 is a block diagram of a computer that is included in the systemof FIG. 1 and that implements the process of FIG. 2, in accordance withembodiments of the present invention.

DETAILED DESCRIPTION Overview

Embodiments of the present invention protect a network from a unicastflood by determining whether to drop or discard an unknown unicast framewithin a predefined period of time. In one embodiment, each frame with adestination MAC address that is unknown to the network is added to an“unknown MAC address table.” If the MAC address is discovered due to theMAC address referencing a silent host, then subsequent frames may beforwarded and not counted as future entries in the table. If the MACaddress remains unlearned, subsequent frames may be counted against thetable until a limit is reached and the frames are discarded. The discardand table entry purge duration is definable by an administrator to be asaggressive or as tolerant as the network and application environmentwarrant.

In one embodiment, the protection of a computer network from a unicastflood by discarding unknown unicast frames within a predefined period oftime facilitates an identification of a malicious host that is trying tosweep the computer network for hosts or deprive the computer network ofbandwidth. In one embodiment, hosts that are sending out unknown unicastframes are identified and an audit of the identified hosts determineswhether any of the hosts are malicious.

System for Protecting a Network from a Unicast Flood

FIG. 1 is a block diagram of a system 100 for protecting a network froma unicast flood, in accordance with embodiments of the presentinvention. System 100 includes a computer networking devices 102-1,102-2, . . . , 102-N, which are required to mediate data and requiredfor communication and interaction between devices on a computer network,where N is an integer greater than or equal to two. In one embodiment,computer networking devices 102-1, 102-2, . . . , 102-N are networkswitches (hereinafter referred to simply as switches). Computernetworking device 102-1 includes a software-based unknown unicast framemanagement system 104 and an unknown MAC address table 106. System 100also includes a host 110 (i.e., a network host), which is a computer orother device which sends frames (i.e., digital data transmission units)to computer networking device 102-1 in a computer network (not shown).In one embodiment, the frames sent by host 110 to computer networkingdevice 102-1 are Ethernet frames.

Unknown unicast frame management system 104 protects the computernetwork from a unicast flood. For each frame received at computernetworking device 102-1 that has a destination MAC address that isunknown to the computer network, unknown unicast frame management system104 adds the destination MAC address to unknown MAC address table 106 ifthe destination MAC address is not already in the unknown MAC addresstable 106. If the destination MAC address is in unknown MAC addresstable 106, then unknown unicast frame management system 104 increments acount of the received frames for which the frames' destination MACaddresses are in unknown MAC address table 106. In response to the countexceeding a predefined threshold, a suppression timer is activated for apredefined period of time, during which subsequent frames received bycomputer networking device 102-1 which have destination MAC addressesthat are in unknown MAC address table 106 are discarded (i.e.,subsequent communication with unknown unicasts in the computer networkis dampened for the predefined of time to prevent a unicast flood).

The functionality of the components shown in FIG. 1 is described in moredetail in the discussion of FIG. 2, FIG. 3, and FIG. 4 presented below.

Process for Protecting a Network from a Unicast Flood

FIG. 2 is a flowchart of a process of protecting a network from aunicast flood, where the process is implemented in the system of FIG. 1,in accordance with embodiments of the present invention. The process ofFIG. 2 starts at step 200. In step 202, unknown unicast frame managementsystem 104 (see FIG. 1) receives a frame (e.g., an Ethernet frame) on anunknown unicast suppressed port in a computer network. The framereceived in step 202 has a destination MAC address (i.e., a MAC addressof the destination of the frame).

In step 204, unknown unicast frame management system 104 (see FIG. 1)determines whether the destination MAC address of the frame received instep 202 is included in a MAC table which maps MAC addresses to portsand is used to route frames in the computer network. Hereinafter, in thediscussion of FIG. 2, the destination MAC address of the frame receivedin step 202 is simply referred to as the MAC address. If unknown unicastframe management system 104 (see FIG. 1) determines in step 204 that theMAC address is in the MAC table, then the Yes branch of step 204 isfollowed and step 206 is performed. In step 206, unknown unicast framemanagement system 104 (see FIG. 1) sends the frame out the forwardinginterface indicated in the MAC table. Following step 206, the process ofFIG. 2 ends at step 208 and may be repeated with a receipt of asubsequent frame starting at step 202.

Returning to step 204, if unknown unicast frame management system 104(see FIG. 1) determines that the MAC address of the frame is not knownin the MAC table, then the No branch of step 204 is followed and step210 is performed.

In step 210, unknown unicast frame management system 104 (see FIG. 1)determines whether the MAC address of the frame is included in unknownMAC address table 106 (see FIG. 1), which stores destination MACaddresses of frames received by computer networking device 102-1 (seeFIG. 1), where the destination MAC addresses are unknown to the computernetwork. Unknown MAC address table 106 (see FIG. 1), which storesunknown destination MAC addresses, is different from the aforementionedMAC table, which maps MAC addresses to ports. If unknown unicast framemanagement system 104 (see FIG. 1) determines in step 210 that the MACaddress is not included in unknown MAC address table 106 (see FIG. 1),then the No branch of step 210 is followed and step 212 is performed.

In step 212, unknown unicast frame management system 104 (see FIG. 1)adds the MAC address to unknown MAC address table 106 (see FIG. 1)together with a timestamp. Step 212 also includes unknown unicast framemanagement system 104 (see FIG. 1) setting a received frame counter to avalue of one (or another predetermined initial value). The receivedframe counter counts the number of frames received in step 202 that havethe MAC address as the address of the destination of the frames.

After step 212, step 206 includes unknown unicast frame managementsystem 104 (see FIG. 1) forwarding the frame to non-blocked spanningtree links to try to find the MAC address in the computer network.Again, following step 206, the process of FIG. 2 ends at step 208 andmay be repeated with a receipt of a subsequent frame starting at step202.

Returning to step 210, if unknown unicast frame management system 104(see FIG. 1) determines that the MAC address of the frame is included inunknown MAC address table 106 (see FIG. 1), then the Yes branch of step210 is followed and step 214 is performed.

In step 214, unknown unicast frame management system 104 (see FIG. 1)determines whether a frame forwarding suppression timer is active (i.e.,whether the frame forwarding suppression timer was activated in step 222for a time interval which has not yet expired, where step 222 isdescribed below). Hereinafter, in the discussion of FIG. 2, the frameforwarding suppression timer is referred to simply as the suppressiontimer. If unknown unicast frame management system 104 (see FIG. 1)determines in step 214 that the suppression timer is active, then theYes branch of step 214 is followed and step 216 is performed.

In step 216, unknown unicast frame management system 104 (see FIG. 1)discards or drops the frame. Following step 216, the process of FIG. 2ends at step 208 and may be repeated starting at step 202 with a receiptof a subsequent frame.

Returning to step 214, if unknown unicast frame management system 104(see FIG. 1) determines that the suppression timer is not active, thenthe No branch of step 214 is followed and step 218 is performed. In step218, unknown unicast frame management system 104 (see FIG. 1) incrementsthe received frame counter (e.g., the value i of the counter becomesi+1) for the MAC address.

In step 220, unknown unicast frame management system 104 (see FIG. 1)determines whether the received frame counter exceeds a predefinedthreshold value. If unknown unicast frame management system 104 (seeFIG. 1) determines in step 220 that the received frame counter exceedsthe threshold value, then the Yes branch of step 220 is followed andstep 222 is performed.

In step 222, unknown unicast frame management system 104 (see FIG. 1)activates the suppression timer for a predefined suppression timeinterval (i.e., a period of time during which unknown unicast framemanagement system 104 (see FIG. 1) discards the frame received in step202). As frames are discarded by performances of step 222 within thesuppression time interval, communications in the computer network aredampened, thereby preventing the computer network from experiencing aunicast flood. Although not shown in FIG. 2, after an expiration of thesuppression time interval, unknown unicast frame management system 104(see FIG. 1) deactivates the suppression timer (i.e., the state of thesuppression timer changes from being active to being not active).

Following step 222, unknown unicast frame management system 104 (seeFIG. 1) discards the frame in step 216. Again, after step 216, theprocess of FIG. 2 ends at step 208 and may be repeated with a receipt ofa subsequent frame at step 202.

Returning to step 220, if unknown unicast frame management system 104(see FIG. 1) determines that the received frame counter does not exceedthe threshold value, then the No branch of step 220 is followed and step206 is performed. In step 206 following step 220, unknown unicast framemanagement system 104 (see FIG. 1) forwards the frame to non-blockedspanning tree links in the computer network to try to find the MACaddress in the computer network. Again, following step 206, the processof FIG. 2 ends at step 208 and may be repeated starting at step 202 witha receipt of a subsequent frame.

FIG. 3 is an example 300 of determining whether to drop or discard anunknown unicast frame within the process of FIG. 2, in accordance withembodiments of the present invention. In example 300, a computer networkincludes a host 302, switch 304, switch 306, switch 308, switch 310, andswitch 312.

In step 321, switch 304 receives from host 302 frames with an unknowndestination MAC address. Step 321 is an example of step 202 (see FIG.2).

In step 322, switch 304 sends frames out to all non-blocked spanningtree links in the computer network to try to find the MAC address in thecomputer network as long as the suppression timer is not active. Step322 is an example of step 206 (see FIG. 2) which follows step 220 (seeFIG. 2) or step 212 (see FIG. 2).

In step 323, after the suppression timer has been activated and is stillactive, switch 304 receives frame(s) with the unknown MAC address anddrops the frame(s) during a predefined time period (i.e., thesuppression interval), thereby dampening communications for thepredefined time period, which prevents a unicast flood in the computernetwork.

Computer System

FIG. 4 is a block diagram of a computer 400 that is included in thesystem of FIG. 1 and that implements the process of FIG. 2, inaccordance with embodiments of the present invention. Computer 400 is acomputer system that generally includes a central processing unit (CPU)402, a memory 404, an input/output (I/O) interface 406, and a bus 408.Further, computer 400 is coupled to I/O devices 410 and a computer datastorage unit 412. CPU 402 performs computation and control functions ofcomputer 400, including executing instructions included in program code414 for unknown unicast frame management system 104 (see FIG. 1) toperform a method of protecting a computer network from a unicast floodby managing unknown unicast frames, where the instructions are executedby CPU 402 via memory 404. CPU 402 may include a single processing unit,or be distributed across one or more processing units in one or morelocations (e.g., on a client and server).

Memory 404 includes a known computer readable storage medium, which isdescribed below. In one embodiment, cache memory elements of memory 404provide temporary storage of at least some program code (e.g., programcode 414) in order to reduce the number of times code must be retrievedfrom bulk storage while instructions of the program code are executed.Moreover, similar to CPU 402, memory 404 may reside at a single physicallocation, including one or more types of data storage, or be distributedacross a plurality of physical systems in various forms. Further, memory404 can include data distributed across, for example, a local areanetwork (LAN) or a wide area network (WAN).

I/O interface 406 includes any system for exchanging information to orfrom an external source. I/O devices 410 include any known type ofexternal device, including a display, keyboard, etc. Bus 408 provides acommunication link between each of the components in computer 400, andmay include any type of transmission link, including electrical,optical, wireless, etc.

I/O interface 406 also allows computer 400 to store information (e.g.,data or program instructions such as program code 414) on and retrievethe information from computer data storage unit 412 or another computerdata storage unit (not shown). Computer data storage unit 412 includes aknown computer-readable storage medium, which is described below. In oneembodiment, computer data storage unit 412 is a non-volatile datastorage device, such as a magnetic disk drive (i.e., hard disk drive) oran optical disc drive (e.g., a CD-ROM drive which receives a CD-ROMdisk).

Memory 404 and/or storage unit 412 may store computer program code 414that includes instructions that are executed by CPU 402 via memory 404to protect a computer network from a unicast flood by managing unknownunicast frames. Although FIG. 4 depicts memory 404 as including programcode, the present invention contemplates embodiments in which memory 404does not include all of code 414 simultaneously, but instead at one timeincludes only a portion of code 414.

Further, memory 404 may include an operating system (not shown) and mayinclude other systems not shown in FIG. 4.

Storage unit 412 and/or one or more other computer data storage units(not shown) that are coupled to computer 400 may include unknown MACaddress table 106 (see FIG. 1).

As will be appreciated by one skilled in the art, in a first embodiment,the present invention may be a method; in a second embodiment, thepresent invention may be a system; and in a third embodiment, thepresent invention may be a computer program product.

Any of the components of an embodiment of the present invention can bedeployed, managed, serviced, etc. by a service provider that offers todeploy or integrate computing infrastructure with respect to protectinga computer network from a unicast flood by managing unknown unicastframes. Thus, an embodiment of the present invention discloses a processfor supporting computer infrastructure, where the process includesproviding at least one support service for at least one of integrating,hosting, maintaining and deploying computer-readable code (e.g., programcode 414) in a computer system (e.g., computer 400) including one ormore processors (e.g., CPU 402), wherein the processor(s) carry outinstructions contained in the code causing the computer system toprotecting a computer network from a unicast flood by managing unknownunicast frames. Another embodiment discloses a process for supportingcomputer infrastructure, where the process includes integratingcomputer-readable program code into a computer system including aprocessor. The step of integrating includes storing the program code ina computer-readable storage device of the computer system through use ofthe processor. The program code, upon being executed by the processor,implements a method of protecting a computer network from a unicastflood by managing unknown unicast frames.

While it is understood that program code 414 for protecting a computernetwork from a unicast flood by managing unknown unicast frames may bedeployed by manually loading directly in client, server and proxycomputers (not shown) via loading a computer-readable storage medium(e.g., computer data storage unit 412), program code 414 may also beautomatically or semi-automatically deployed into computer 400 bysending program code 414 to a central server or a group of centralservers. Program code 414 is then downloaded into client computers(e.g., computer 400) that will execute program code 414. Alternatively,program code 414 is sent directly to the client computer via e-mail.Program code 414 is then either detached to a directory on the clientcomputer or loaded into a directory on the client computer by a buttonon the e-mail that executes a program that detaches program code 414into a directory. Another alternative is to send program code 414directly to a directory on the client computer hard drive. In a case inwhich there are proxy servers, the process selects the proxy servercode, determines on which computers to place the proxy servers' code,transmits the proxy server code, and then installs the proxy server codeon the proxy computer. Program code 414 is transmitted to the proxyserver and then it is stored on the proxy server.

Another embodiment of the invention provides a method that performs theprocess steps on a subscription, advertising and/or fee basis. That is,a service provider can offer to create, maintain, support, etc. aprocess of protecting a computer network from a unicast flood bymanaging unknown unicast frames. In this case, the service provider cancreate, maintain, support, etc. a computer infrastructure that performsthe process steps for one or more customers. In return, the serviceprovider can receive payment from the customer(s) under a subscriptionand/or fee agreement, and/or the service provider can receive paymentfrom the sale of advertising content to one or more third parties.

The present invention may be a system, a method, and/or a computerprogram product at any possible technical detail level of integration.The computer program product may include a computer readable storagemedium (or media) (i.e., memory 404 and computer data storage unit 412)having computer readable program instructions 414 thereon for causing aprocessor (e.g., CPU 402) to carry out aspects of the present invention.

The computer readable storage medium can be a tangible device that canretain and store instructions (e.g., program code 414) for use by aninstruction execution device (e.g., computer 400). The computer readablestorage medium may be, for example, but is not limited to, an electronicstorage device, a magnetic storage device, an optical storage device, anelectromagnetic storage device, a semiconductor storage device, or anysuitable combination of the foregoing. A non-exhaustive list of morespecific examples of the computer readable storage medium includes thefollowing: a portable computer diskette, a hard disk, a random accessmemory (RAM), a read-only memory (ROM), an erasable programmableread-only memory (EPROM or Flash memory), a static random access memory(SRAM), a portable compact disc read-only memory (CD-ROM), a digitalversatile disk (DVD), a memory stick, a floppy disk, a mechanicallyencoded device such as punch-cards or raised structures in a groovehaving instructions recorded thereon, and any suitable combination ofthe foregoing. A computer readable storage medium, as used herein, isnot to be construed as being transitory signals per se, such as radiowaves or other freely propagating electromagnetic waves, electromagneticwaves propagating through a waveguide or other transmission media (e.g.,light pulses passing through a fiber-optic cable), or electrical signalstransmitted through a wire.

Computer readable program instructions (e.g., program code 414)described herein can be downloaded to respective computing/processingdevices (e.g., computer 400) from a computer readable storage medium orto an external computer or external storage device (e.g., computer datastorage unit 412) via a network (not shown), for example, the Internet,a local area network, a wide area network and/or a wireless network. Thenetwork may comprise copper transmission cables, optical transmissionfibers, wireless transmission, routers, firewalls, switches, gatewaycomputers and/or edge servers. A network adapter card (not shown) ornetwork interface (not shown) in each computing/processing devicereceives computer readable program instructions from the network andforwards the computer readable program instructions for storage in acomputer readable storage medium within the respectivecomputing/processing device.

Computer readable program instructions (e.g., program code 414) forcarrying out operations of the present invention may be assemblerinstructions, instruction-set-architecture (ISA) instructions, machineinstructions, machine dependent instructions, microcode, firmwareinstructions, state-setting data, configuration data for integratedcircuitry, or either source code or object code written in anycombination of one or more programming languages, including an objectoriented programming language such as Smalltalk, C++, or the like, andprocedural programming languages, such as the “C” programming languageor similar programming languages. The computer readable programinstructions may execute entirely on the user's computer, partly on theuser's computer, as a stand-alone software package, partly on the user'scomputer and partly on a remote computer or entirely on the remotecomputer or server. In the latter scenario, the remote computer may beconnected to the user's computer through any type of network, includinga local area network (LAN) or a wide area network (WAN), or theconnection may be made to an external computer (for example, through theInternet using an Internet Service Provider). In some embodiments,electronic circuitry including, for example, programmable logiccircuitry, field-programmable gate arrays (FPGA), or programmable logicarrays (PLA) may execute the computer readable program instructions byutilizing state information of the computer readable programinstructions to personalize the electronic circuitry, in order toperform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations (e.g., FIG. 2) and/or block diagrams (e.g., FIG.1 and FIG. 4) of methods, apparatus (systems), and computer programproducts according to embodiments of the invention. It will beunderstood that each block of the flowchart illustrations and/or blockdiagrams, and combinations of blocks in the flowchart illustrationsand/or block diagrams, can be implemented by computer readable programinstructions (e.g., program code 414).

These computer readable program instructions may be provided to aprocessor (e.g., CPU 402) of a general purpose computer, special purposecomputer, or other programmable data processing apparatus (e.g.,computer 400) to produce a machine, such that the instructions, whichexecute via the processor of the computer or other programmable dataprocessing apparatus, create means for implementing the functions/actsspecified in the flowchart and/or block diagram block or blocks. Thesecomputer readable program instructions may also be stored in a computerreadable storage medium (e.g., computer data storage unit 412) that candirect a computer, a programmable data processing apparatus, and/orother devices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions (e.g., program code 414) mayalso be loaded onto a computer (e.g. computer 400), other programmabledata processing apparatus, or other device to cause a series ofoperational steps to be performed on the computer, other programmableapparatus or other device to produce a computer implemented process,such that the instructions which execute on the computer, otherprogrammable apparatus, or other device implement the functions/actsspecified in the flowchart and/or block diagram block or blocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the block may occur out of theorder noted in the Figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

While embodiments of the present invention have been described hereinfor purposes of illustration, many modifications and changes will becomeapparent to those skilled in the art. Accordingly, the appended claimsare intended to encompass all such modifications and changes as fallwithin the true spirit and scope of this invention.

What is claimed is:
 1. A method of protecting a network from a unicastflood, the method comprising the steps of: a processor in a switch ofthe network determining whether a media access control (MAC) address ofa frame is included in a table of unknown MAC addresses, the MAC addressbeing an address of a destination of the frame; and if the MAC addressis not included in the table, the processor adding the MAC address tothe table together with a timestamp and forwarding the frame tonon-blocked spanning tree links to attempt to find the MAC address inthe network, or if the MAC address is included in the table, theprocessor determining whether a timer for suppressing forwarding offrames is active, and if the timer for suppressing forwarding of framesis active, the processor discarding the frame, or if the timer forsuppressing forwarding of frames is not active, the processorincrementing a counter for counting received frames and determiningwhether the counter is greater than a threshold value, and if thecounter is greater than the threshold value, the processor activatingthe timer for suppressing forwarding of frames for a period of time anddiscarding the frame, or if the counter is not greater than thethreshold value, the processor forwarding the frame to the non-blockedspanning tree links to attempt to find the MAC address in the network.2. The method of claim 1, further comprising the step of the processorreceiving the frame on an unknown unicast suppressed port, the framebeing an Ethernet frame.
 3. The method of claim 1, further comprisingthe steps of: in response to the step of forwarding the frame to thenon-blocked spanning tree links to attempt to find the MAC address inthe network, the processor determining that the destination MAC addressidentifies a silent host in the network; and based on the MAC addressidentifying the silent host, the processor forwarding subsequent framesto the MAC address without adding to the table the MAC address of thedestinations of the subsequent frames.
 4. The method of claim 1, whereinthe step of forwarding the frame to non-blocked spanning tree links toattempt to find the MAC address in the network includes forwarding theframe for a first predefined period of time or until a data limit isreached.
 5. The method of claim 4, further comprising the steps of: theprocessor determining that the MAC address is not found in the networkafter the first predefined period of time or the data limit is reached;and in response to the step of determining that the MAC address is notfound, the processor dropping, for a second predefined period of time,subsequent frames that are received by the switch, the subsequent frameshaving the MAC address as a destination of the subsequent frames.
 6. Themethod of claim 1, further comprising the steps of: the processorreceiving a second frame having a second MAC address as a destination ofthe second frame; the processor determining that the second MAC addressis known to the network; and based on the second MAC address being knownto the network, the processor forwarding the second frame to the secondMAC address.
 7. The method of claim 1, further comprising the steps of:the processor receiving a second frame having a second MAC address thatis unknown to the network, the second MAC address being an address of adestination of the second frame; the processor determining that thesecond MAC address is not included in the table; and based on the secondMAC address being not included in the table, the processor adding thesecond MAC address to the table together with a second timestamp andforwarding the second frame to non-blocked spanning tree links toattempt to find the second MAC address in the network, the step offorwarding continuing until a data limit for forwarding the second frameis reached.
 8. The method of claim 1, further comprising the step of:providing at least one support service for at least one of creating,integrating, hosting, maintaining, and deploying computer readableprogram code in the computer, the program code being executed by aprocessor of the computer to implement the steps of determining whetherthe MAC address is included in the table, and if the MAC address is notincluded in the table, adding the MAC address to the table together withthe timestamp and forwarding the frame to non-blocked spanning treelinks, or if the MAC address is included in the table, determiningwhether the timer is active, and if the timer is active, discarding theframe, or if the timer is not active, incrementing the counter anddetermining whether the counter is greater than the threshold value, andif the counter is greater than the threshold value, activating the timerand discarding the frame, or if the counter is not greater than thethreshold value, forwarding the frame to non-blocked spanning treelinks.